3c1029d521ba448c4150d58bd75fd1646f54d72d95d0f91f5dd60656f55eff9a

Analysis

max time kernel
130s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2023, 20:29

Target

fabric-installer-0.11.2.exe
Size

399KB
MD5

0604fd84edc6059d39a631eb0ce5a546
SHA1

9ecd7d7df70a25d5ba0ff81e7ad6b59280f71bb6
SHA256

3c1029d521ba448c4150d58bd75fd1646f54d72d95d0f91f5dd60656f55eff9a
SHA512

68e727ea4515ac385e4d757a5e6cff3005ccf50b54e7b5ee1bbb100f18afc09cd814138d31b9e4237a3170bbb3e4a9554e1b4294ec866cd6f63b6e461da8db09
SSDEEP

6144:XbOTF9+lw27APRw3zeFAO8X+KAWCXgy/kJ1o2ww5OxLRfSA4syabpAq:L+z+u9ZF6uKAWCQy/c1HwnBBfL

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3204	javaw.exe
3204	javaw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1172	3804	fabric-installer-0.11.2.exe	85
PID 3804 wrote to memory of 1172	3804	fabric-installer-0.11.2.exe	85
PID 3804 wrote to memory of 3204	3804	fabric-installer-0.11.2.exe	86
PID 3804 wrote to memory of 3204	3804	fabric-installer-0.11.2.exe	86

C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe
"C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\ProgramData\Oracle\Java\javapath\javaw.exe
  "javaw.exe" "-version"
  2⤵
  PID:1172
- C:\ProgramData\Oracle\Java\javapath\javaw.exe
  "javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe" "-fabricInstallerBootstrap" "true"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3204

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
3b90cf5078e6c8f63e16c3daa3337ba2

SHA1
63d51e1efebf38e31de63df5458eab2cfb357ad8

SHA256
d58ab0b06827e38d51158b58d8793b2d37f1829410d73a503879f2bbb01420d2

SHA512
0c0dc112129208eaa91ac958dbe5b78430047b4d1f75c2c25e4109b212d12daa41530593c0fe07caed8a1944d1c3be78c07a99b6966dbd0fb3edc267d8f32463

Download Submit
memory/1172-144-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3204-156-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-161-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-189-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-200-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-204-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-217-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-223-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-227-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-228-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3204-229-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download